[SECURITY] [DLA 2648-2] mediawiki regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2648-2 [email protected] https://www.debian.org/lts/security/ Abhijith PA May 07, 2021 https://wiki.debian.org/LTS -...

USN-4918-3 clamav regression

USN-4918-1 fixed vulnerabilities in ClamAV. The updated package could fail to properly scan in some situations. This update fixes the problem. Original advisory details: It was discovered that ClamAV incorrectly handled parsing Excel documents. A remote attacker could possibly use this issue to...

USN-4918-3: ClamAV regression

USN-4918-1 fixed vulnerabilities in ClamAV. The updated package could fail to properly scan in some situations. This update fixes the problem. Original advisory details: It was discovered that ClamAV incorrectly handled parsing Excel documents. A remote attacker could possibly use this issue to...

skia:api_raster_n32_canvas: Heap-use-after-free in SkMatrix::Trans_pts

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5897403099119616 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: apirastern32canvas Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

freetype2:colrv1: Heap-buffer-overflow in tt_face_get_paint_layers

Detailed Report: https://oss-fuzz.com/testcase?key=6215123103514624 Project: freetype2 Fuzzing Engine: afl Fuzz Target: colrv1 Job Type: aflasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62a000012546 Crash State: ttfacegetpaintlayers FTGetPaintLayers...

Object injection via local phar file

This is a security release. SECURITY Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as ssh2 Ensure method signature consisten...

sleuthkit:sleuthkit_fls_apfs_fuzzer: Index-out-of-bounds in tsk_img_read

Detailed Report: https://oss-fuzz.com/testcase?key=6274420898398208 Project: sleuthkit Fuzzing Engine: libFuzzer Fuzz Target: sleuthkitflsapfsfuzzer Job Type: libfuzzerubsansleuthkit Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: tskimgread APFSPool::read...

jsoncons:fuzz_json_encoder: Container-overflow in unsigned long jsoncons::detail::escape_string<char, jsoncons::string_sink<std::_

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5639543840702464 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsonencoder Job Type: libfuzzerasanjsoncons Platform Id: linux Crash Type: Container-overflow READ 1 Crash Addres...

ffmpeg:ffmpeg_AV_CODEC_ID_MJPEG_fuzzer: Heap-buffer-overflow in shift_output

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5778775641030656 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDMJPEGfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

lxc:fuzz-lxc-define-load: Heap-buffer-overflow in strlcpy

Project: https://github.com/lxc/lxc.git Detailed Report: https://oss-fuzz.com/testcase?key=6387887164751872 Project: lxc Fuzzing Engine: libFuzzer Fuzz Target: fuzz-lxc-define-load Job Type: libfuzzerasanlxc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x629000004780...

USN-4916-2: Linux kernel regression

USN-4916-1 fixed vulnerabilities in the Linux kernel. Unfortunately, the fix for CVE-2021-3493 introduced a memory leak in some situations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the overlayfs implementation in the Linu...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Linux kernel regression (USN-4916-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4916-2 advisory. USN-4916-1 fixed vulnerabilities in the Linux kernel. Unfortunately, the fix for CVE-2021-3493 introduced a memory leak in some situations...

SUSE: Security Advisory (SUSE-SU-2019:1935-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2017:2094-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2015:1127-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2017:0517-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2019:2053-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2017:1778-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2017:1915-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2019:2426-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...